{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T10:59:35Z","timestamp":1784631575642,"version":"3.55.0"},"reference-count":192,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"11","license":[{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"State Key Laboratory of General Artificial Intelligence"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Neural Netw. Learning Syst."],"published-print":{"date-parts":[[2025,11]]},"DOI":"10.1109\/tnnls.2025.3592935","type":"journal-article","created":{"date-parts":[[2025,8,18]],"date-time":"2025-08-18T19:45:16Z","timestamp":1755546316000},"page":"19525-19545","source":"Crossref","is-referenced-by-count":39,"title":["A Survey of Attacks on Large Vision\u2013Language Models: Resources, Advances, and Future Trends"],"prefix":"10.1109","volume":"36","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8179-4508","authenticated-orcid":false,"given":"Daizong","family":"Liu","sequence":"first","affiliation":[{"name":"Wangxuan Institute of Computer Technology, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingyu","family":"Yang","sequence":"additional","affiliation":[{"name":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4907-3978","authenticated-orcid":false,"given":"Xiaoye","family":"Qu","sequence":"additional","affiliation":[{"name":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8629-4622","authenticated-orcid":false,"given":"Pan","family":"Zhou","sequence":"additional","affiliation":[{"name":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7901-8662","authenticated-orcid":false,"given":"Yu","family":"Cheng","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, The Chinese University of Hong Kong, Shatin, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9860-0922","authenticated-orcid":false,"given":"Wei","family":"Hu","sequence":"additional","affiliation":[{"name":"Wangxuan Institute of Computer Technology, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"GPT-4 technical report","volume-title":"arXiv:2303.08774","author":"Achiam","year":"2023"},{"key":"ref2","first-page":"23716","article-title":"Flamingo: A visual language model for few-shot learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Alayrac"},{"key":"ref3","article-title":"Gemini: A family of highly capable multimodal models","author":"Team","year":"2023","journal-title":"arXiv:2312.11805"},{"key":"ref4","volume-title":"Introducing the Next Generation of Claude","year":"2024"},{"key":"ref5","article-title":"OpenFlamingo: An open-source framework for training large autoregressive vision-language models","author":"Awadalla","year":"2023","journal-title":"arXiv:2308.01390"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.61969\/jai.1311271"},{"key":"ref7","article-title":"Abusing images and sounds for indirect instruction injection in multi-modal LLMs","author":"Bagdasaryan","year":"2023","journal-title":"arXiv:2307.10490"},{"key":"ref8","article-title":"Qwen technical report","volume-title":"arXiv:2309.16609","author":"Bai","year":"2023"},{"key":"ref9","article-title":"Qwen-VL: A versatile vision-language model for understanding, localization, text reading, and beyond","author":"Bai","year":"2023","journal-title":"arXiv:2308.12966"},{"key":"ref10","first-page":"2443","article-title":"Image hijacks: Adversarial images can control generative models at runtime","volume-title":"Proc. 41st Int. Conf. Mach. Learn.","author":"Bailey"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.3390\/mti2030047"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00017"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2025.3545101"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3264418"},{"key":"ref15","first-page":"4356","article-title":"Man is to computer programmer as woman is to homemaker? Debiasing word embeddings","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"29","author":"Bolukbasi"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2024.3386642"},{"key":"ref17","first-page":"1059","article-title":"High-performance large-scale image recognition without normalization","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Brock"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2024.3497992"},{"key":"ref19","first-page":"61478","article-title":"Are aligned neural networks adversarially aligned?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Carlini"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref21","article-title":"Cross-modal safety alignment: Is textual unlearning all you need?","author":"Chakraborty","year":"2024","journal-title":"arXiv:2406.02575"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.2984972"},{"key":"ref23","article-title":"Universal adversarial perturbations: A survey","author":"Chaubey","year":"2020","journal-title":"arXiv:2005.08087"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01851"},{"key":"ref25","article-title":"MiniGPT-v2: Large language model as a unified interface for vision-language multi-task learning","author":"Chen","year":"2023","journal-title":"arXiv:2310.09478"},{"key":"ref26","article-title":"Towards physically realizable adversarial attacks in embodied vision navigation","author":"Chen","year":"2024","journal-title":"arXiv:2409.10071"},{"key":"ref27","first-page":"1","article-title":"Red teaming GPT-4V: Are GPT-4V safe against uni\/multi-modal Jailbreak attacks?","volume-title":"Proc. ICLR Workshop Secure Trustworthy Large Lang. Models","author":"Chen"},{"key":"ref28","first-page":"1","article-title":"Zer0-jack: A memory-efficient gradient-based jailbreaking method for black box multi-modal large language models","volume-title":"Proc. Neurips Safe Generative AI Workshop","author":"Chen"},{"key":"ref29","article-title":"Can language models be instructed to protect personal information?","author":"Chen","year":"2023","journal-title":"arXiv:2310.02224"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01350"},{"key":"ref31","article-title":"Manipulation facing threats: Evaluating physical vulnerabilities in end-to-end vision language action models","author":"Cheng","year":"2024","journal-title":"arXiv:2409.13174"},{"key":"ref32","first-page":"1","article-title":"Query-efficient hard-label black-box attack: An optimization-based approach","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Cheng"},{"key":"ref33","article-title":"Sign-OPT: A query-efficient hard-label adversarial attack","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Cheng"},{"key":"ref34","volume-title":"Vicuna: An Open-Source Chatbot Impressing Gpt-4 With 90% ChatGPT Quality","author":"Chiang","year":"2023"},{"key":"ref35","article-title":"Breaking down the defenses: A comparative survey of attacks on large language models","author":"Ghosh Chowdhury","year":"2024","journal-title":"arXiv:2403.04786"},{"issue":"70","key":"ref36","first-page":"1","article-title":"Scaling instruction-finetuned language models","volume":"25","author":"Chung","year":"2022","journal-title":"J. Mach. Learn. Res."},{"key":"ref37","article-title":"Towards transferable attacks against vision-LLMs in autonomous driving with typography","author":"Chung","year":"2024","journal-title":"arXiv:2405.14169"},{"key":"ref38","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02325"},{"key":"ref40","first-page":"49250","article-title":"InstructBLIP: Towards general-purpose vision-language models with instruction tuning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Dai"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-019-8208-z"},{"key":"ref43","article-title":"How robust is Google\u2019s bard to adversarial image attacks?","author":"Dong","year":"2023","journal-title":"R0-FoMo: Robustness of Few-shot and Zero-shot Learning in Large Foundation Models"},{"key":"ref44","article-title":"Towards a rigorous science of interpretable machine learning","author":"Doshi-Velez","year":"2017","journal-title":"arXiv:1702.08608"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/SMC54092.2024.10831129"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01855"},{"key":"ref47","article-title":"PG-attack: A precision-guided adversarial attack framework against vision foundation models for autonomous driving","author":"Fu","year":"2024","journal-title":"arXiv:2407.13111"},{"key":"ref48","article-title":"Misusing tools in large language models with visual adversarial examples","author":"Fu","year":"2023","journal-title":"arXiv:2310.03185"},{"key":"ref49","article-title":"Adversarial robustness for visual grounding of multimodal large language models","volume-title":"Proc. ICLR Workshop Reliable Responsible Found. Models","author":"Gao"},{"key":"ref50","article-title":"Inducing high energy-latency of large vision-language models with verbose images","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Gao"},{"key":"ref51","article-title":"LLaMA-adapter v2: Parameter-efficient visual instruction model","author":"Gao","year":"2023","journal-title":"arXiv:2304.15010"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2023.3327962"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.301"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01457"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i22.34568"},{"key":"ref56","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72643-9_23"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.670"},{"key":"ref59","first-page":"346","article-title":"Agent smith: A single image can jailbreak one million multimodal LLM agents exponentially fast","volume-title":"Proc. 41st Int. Conf. Mach. Learn. (ICML)","author":"Gu"},{"key":"ref60","first-page":"2484","article-title":"Simple black-box adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Guo"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3518072"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2025.3548047"},{"key":"ref63","article-title":"Benchmarking neural network robustness to common corruptions and perturbations","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Hendrycks"},{"key":"ref64","first-page":"30016","article-title":"Training compute-optimal large language models","volume-title":"Proc. 36th Int. Conf. Neural Inf. Process. Syst.","author":"Hoffmann"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i3.27999"},{"key":"ref66","article-title":"Membership inference attacks against vision-language models","author":"Hu","year":"2025","journal-title":"arXiv:2501.18624"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2023.3330926"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i4.32396"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/IROS58592.2024.10802618"},{"key":"ref71","article-title":"Mixtral of experts","author":"Jiang","year":"2024","journal-title":"arXiv:2401.04088"},{"key":"ref72","article-title":"Doubly-universal adversarial perturbations: Deceiving vision-language models across both images and text with a single perturbation","author":"Kim","year":"2024","journal-title":"arXiv:2412.08108"},{"key":"ref73","article-title":"Empirical analysis of large vision-language models against goal hijacking via visual prompt injection","author":"Kimura","year":"2024","journal-title":"arXiv:2408.03554"},{"key":"ref74","first-page":"19730","article-title":"BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02304"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.198"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73464-9_11"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i26.34956"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.5220\/0012863100003767"},{"key":"ref80","article-title":"VL-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models","author":"Liang","year":"2024","journal-title":"arXiv:2402.13851"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2922958"},{"key":"ref82","article-title":"Revisiting backdoor attacks against large vision-language models from domain shift","author":"Liang","year":"2024","journal-title":"arXiv:2406.18844"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.311"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1201\/9781003362845-40"},{"key":"ref86","first-page":"32400","article-title":"SPHINX-X: Scaling data and parameters for a family of multi-modal large language models","volume-title":"Proc. 41st Int. Conf. Mach. Learn.","volume":"235","author":"Liu"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02484"},{"key":"ref88","first-page":"34892","article-title":"Visual instruction tuning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Liu"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3114188"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72992-8_22"},{"key":"ref91","article-title":"Safety of multimodal large language models on images and texts","author":"Liu","year":"2024","journal-title":"arXiv:2402.00357"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3681379"},{"key":"ref93","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Liu"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3227717"},{"key":"ref95","article-title":"Test-time backdoor attacks on multimodal large language models","author":"Lu","year":"2024","journal-title":"arXiv:2402.08577"},{"key":"ref96","first-page":"1","article-title":"An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Luo"},{"key":"ref97","article-title":"JailBreakV: A benchmark for assessing the robustness of MultiModal large language models against jailbreak attacks","author":"Luo","year":"2024","journal-title":"arXiv:2404.03027"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3216981"},{"key":"ref99","article-title":"Visual-RolePlay: Universal jailbreak attack on MultiModal large language models via role-playing image character","author":"Ma","year":"2024","journal-title":"arXiv:2405.20773"},{"key":"ref100","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00331"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3457607"},{"key":"ref103","volume-title":"The Art of Deception: Controlling the Human Element of Security","author":"Mitnick","year":"2003"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.3032227"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2025.3558857"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1007\/s10208-015-9296-2"},{"key":"ref108","article-title":"Physical backdoor attack can jeopardize driving with vision-large-language models","author":"Ni","year":"2024","journal-title":"arXiv:2404.12916"},{"key":"ref109","first-page":"16784","article-title":"GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Nichol"},{"key":"ref110","article-title":"Jailbreaking attack against multimodal large language model","author":"Niu","year":"2024","journal-title":"arXiv:2402.02309"},{"key":"ref111","article-title":"UniGuard: Towards universal safety guardrails for jailbreak attacks on multimodal large language models","author":"Oh","year":"2024","journal-title":"arXiv:2411.01703"},{"key":"ref112","article-title":"GPT-4 technical report","author":"Achiam","year":"2023","journal-title":"arXiv:2303.08774"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3188569"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.895"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.303"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-9326-7_1"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"ref118","article-title":"Vision-LLMs can fool themselves with self-generated typographic attacks","author":"Qraitem","year":"2024","journal-title":"arXiv:2402.00626"},{"key":"ref119","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Radford"},{"key":"ref120","article-title":"Universal adversarial attack on aligned multimodal LLMs","author":"Rahmatullaev","year":"2025","journal-title":"arXiv:2502.07987"},{"key":"ref121","article-title":"Hierarchical text-conditional image generation with CLIP latents","author":"Ramesh","year":"2022","journal-title":"arXiv:2204.06125"},{"key":"ref122","first-page":"8821","article-title":"Zero-shot text-to-image generation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ramesh"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref124","article-title":"When do universal image jailbreaks transfer between vision-language models?","volume-title":"Proc. 3rd Workshop New Frontiers Adversarial Mach. Learn.","author":"Schaeffer"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW60793.2023.00395"},{"key":"ref126","article-title":"Safe, multi-agent, reinforcement learning for autonomous driving","author":"Shalev-Shwartz","year":"2016","journal-title":"arXiv:1610.03295"},{"key":"ref127","article-title":"Refusing safe prompts for multi-modal large language models","author":"Shao","year":"2024","journal-title":"arXiv:2407.09050"},{"key":"ref128","article-title":"Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Shayegani"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i7.32734"},{"key":"ref130","first-page":"11","article-title":"PandaGPT: One model to instruction-follow them all","volume-title":"Proc. 1st Workshop Taming Large Lang. Models, Controllability era Interact. Assistants!","author":"Su"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3165573"},{"key":"ref132","article-title":"The wolf within: Covert injection of malice into MLLM societies via an MLLM operative","author":"Tan","year":"2024","journal-title":"arXiv:2402.14859"},{"key":"ref133","article-title":"ImgTrojan: Jailbreaking vision-language models with ONE image","author":"Tao","year":"2024","journal-title":"arXiv:2403.02910"},{"key":"ref134","volume-title":"Introducing MPT-7B: A New Standard for Open-Source, Commercially Usable LLMs, 2023","year":"2023"},{"key":"ref135","article-title":"Heuristic-induced multimodal risk distribution jailbreak attack for multimodal large language models","author":"Teng","year":"2024","journal-title":"arXiv:2412.05934"},{"key":"ref136","article-title":"LLaMA: Open and efficient foundation language models","author":"Touvron","year":"2023","journal-title":"arXiv:2302.13971"},{"key":"ref137","article-title":"Llama 2: Open foundation and fine-tuned chat models","author":"Touvron","year":"2023","journal-title":"arXiv:2307.09288"},{"key":"ref138","article-title":"Ensemble adversarial training: Attacks and defenses","author":"Tram\u00e8r","year":"2017","journal-title":"arXiv:1705.07204"},{"key":"ref139","first-page":"200","article-title":"Multimodal few-shot learning with frozen language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tsimpoukelli"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72983-6_3"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01494"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00102"},{"key":"ref144","article-title":"Black-box adversarial attack on vision language models for autonomous driving","author":"Wang","year":"2025","journal-title":"arXiv:2501.13563"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2023.3331841"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.585"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2025.3539006"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3681092"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.973"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-96-0151-6_1"},{"key":"ref151","article-title":"Exploring the adversarial vulnerabilities of vision-language-action models in robotics","author":"Wang","year":"2024","journal-title":"arXiv:2411.13587"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref153","article-title":"InstructTA: Instruction-tuned targeted attack for large vision-language models","author":"Wang","year":"2023","journal-title":"arXiv:2312.01886"},{"key":"ref154","article-title":"TrojanRobot: Physical-world backdoor attacks against VLM-based robotic manipulation","author":"Wang","year":"2024","journal-title":"arXiv:2411.11683"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680779"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72661-3_5"},{"key":"ref157","article-title":"Jailbreak large vision-language models through multi-modal linkage","author":"Wang","year":"2024","journal-title":"arXiv:2412.00473"},{"key":"ref158","article-title":"Stop reasoning! When multimodal LLM with chain-of-thought reasoning meets adversarial image","author":"Wang","year":"2024","journal-title":"arXiv:2402.14899"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.37190\/arc220310"},{"key":"ref160","article-title":"Dissecting adversarial robustness of multimodal LM agents","author":"Henry Wu","year":"2024","journal-title":"arXiv:2406.12814"},{"key":"ref161","article-title":"On the vulnerability of LLM\/VLM-controlled robotics","author":"Wu","year":"2024","journal-title":"arXiv:2402.10340"},{"key":"ref162","article-title":"Jailbreaking GPT-4V via self-adversarial attacks with system prompts","author":"Wu","year":"2023","journal-title":"arXiv:2311.09127"},{"key":"ref163","article-title":"CARES: A comprehensive benchmark of trustworthiness in medical vision language models","author":"Xia","year":"2024","journal-title":"arXiv:2406.06007"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2019.2915033"},{"key":"ref165","article-title":"AutoTrust: Benchmarking trustworthiness in large vision language models for autonomous driving","author":"Xing","year":"2024","journal-title":"arXiv:2412.15206"},{"key":"ref166","first-page":"1","article-title":"Shadowcast: Stealthy data poisoning attacks against vision-language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","author":"Xu"},{"key":"ref167","first-page":"10678","article-title":"Robust contrastive language-image pretraining against data poisoning and backdoor attacks","volume-title":"Proc. NeurIPS","author":"Yang"},{"key":"ref168","article-title":"Effective black-box multi-faceted attacks breach vision large language model guardrails","author":"Yang","year":"2025","journal-title":"arXiv:2502.05772"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2018.2855422"},{"key":"ref170","article-title":"Hijacking vision-and-language navigation agents with adversarial environmental attacks","author":"Yang","year":"2024","journal-title":"arXiv:2412.02795"},{"key":"ref171","article-title":"Unveiling the safety of GPT-4o: An empirical study using jailbreak attacks","author":"Ying","year":"2024","journal-title":"arXiv:2406.06302"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2817340"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2983149"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2024.3520306"},{"key":"ref176","article-title":"BadRobot: Jailbreaking embodied LLMs in the physical world","author":"Zhang","year":"2024","journal-title":"arXiv:2407.20242"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3185320"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2019.2933524"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.02011"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"ref181","article-title":"AnyAttack: Towards large-scale self-supervised adversarial attacks on vision-language models","author":"Zhang","year":"2024","journal-title":"arXiv:2410.05346"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657781"},{"key":"ref183","article-title":"OPT: Open pre-trained transformer language models","author":"Zhang","year":"2022","journal-title":"arXiv:2205.01068"},{"key":"ref184","article-title":"Visual adversarial attack on vision-language models for autonomous driving","author":"Zhang","year":"2024","journal-title":"arXiv:2411.18275"},{"key":"ref185","article-title":"JailGuard: A universal detection framework for LLM prompt-based attacks","author":"Zhang","year":"2023","journal-title":"arXiv:2312.10766"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02508"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1323"},{"key":"ref188","article-title":"Jailbreaking multimodal large language models via shuffle inconsistency","author":"Zhao","year":"2025","journal-title":"arXiv:2501.04931"},{"key":"ref189","first-page":"54111","article-title":"On evaluating adversarial robustness of large vision-language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhao"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2025.3554656"},{"key":"ref191","article-title":"MiniGPT-4: Enhancing vision-language understanding with advanced large language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Zhu"},{"key":"ref192","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv:2307.15043"}],"container-title":["IEEE Transactions on Neural Networks and Learning Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/5962385\/11220834\/11127221.pdf?arnumber=11127221","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,30]],"date-time":"2025-10-30T18:03:21Z","timestamp":1761847401000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11127221\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11]]},"references-count":192,"journal-issue":{"issue":"11"},"URL":"https:\/\/doi.org\/10.1109\/tnnls.2025.3592935","relation":{},"ISSN":["2162-237X","2162-2388"],"issn-type":[{"value":"2162-237X","type":"print"},{"value":"2162-2388","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11]]}}}